Buggy code:
public class SelfSignedSslEngineSource implements SslEngineSource { private static final Logger LOG = LoggerFactory . getLogger ( SelfSignedSslEngineSource . class ) ; private static final String ALIAS = "littleproxy" ; private static final String PASSWORD = "Be<seq2seq4repair_space>Your<seq2seq4repair_space>Own<seq2seq4repair_space>Lantern" ; private static final String PROTOCOL = "TLS" ; private static final String KEY_STORE_TYPE = "jks" ; private static final String SIG_ALG_NAME = "SHA256withRSA" ; private final File keyStoreFile ; private final boolean trustAllServers ; private final boolean sendCerts ; private SSLContext sslContext ; private KeyStore keyStore ; private ConcurrentHashMap < String , SoftReference < SSLContext > > sslContextCache = new ConcurrentHashMap < > ( ) ; public SelfSignedSslEngineSource ( String keyStorePath , boolean trustAllServers , boolean sendCerts ) { } public SelfSignedSslEngineSource ( String keyStorePath ) { } public SelfSignedSslEngineSource ( boolean trustAllServers ) { } public SelfSignedSslEngineSource ( boolean trustAllServers , boolean sendCerts ) { } public SelfSignedSslEngineSource ( ) { } @ Override public SSLEngine newSslEngine ( ) { } public SSLEngine clientSslEngineFor ( SSLSession remoteServerSslSession ) { try { String sslContextKey = ( ( remoteServerSslSession . getPeerHost ( ) ) + ":" ) + ( remoteServerSslSession . getPeerPort ( ) ) ; SSLContext newSslContext = null ; if ( ( ! ( sslContextCache . contains ( sslContextKey ) ) ) || ( ( newSslContext = sslContextCache . get ( sslContextKey ) . get ( ) ) == null ) ) { X509Certificate [ ] remoteServerCertChain = remoteServerSslSession . getPeerCertificateChain ( ) ; X509CertImpl remoteServerCert = new X509CertImpl ( remoteServerCertChain [ 0 ] . getEncoded ( ) ) ; X509CertInfo remoteServerCertInfo = ( ( X509CertInfo ) ( remoteServerCert . get ( ( ( ( X509CertImpl . NAME ) + "." ) + ( X509CertImpl . INFO ) ) ) ) ) ; newSslContext = SSLContext . getInstance ( "SSL" ) ; X509CertImpl caCert = new X509CertImpl ( keyStore . getCertificate ( SelfSignedSslEngineSource . ALIAS ) . getEncoded ( ) ) ; PrivateKey caPrivateKey = ( ( PrivateKey ) ( keyStore . getKey ( SelfSignedSslEngineSource . ALIAS , SelfSignedSslEngineSource . PASSWORD . toCharArray ( ) ) ) ) ; PublicKey caPublicKey = caCert . getPublicKey ( ) ; X509CertInfo caCertInfo = ( ( X509CertInfo ) ( caCert . get ( ( ( ( X509CertImpl . NAME ) + "." ) + ( X509CertImpl . INFO ) ) ) ) ) ; X500Name issuer = ( ( X500Name ) ( caCertInfo . get ( ( ( ( X509CertInfo . SUBJECT ) + "." ) + ( CertificateIssuerName . DN_NAME ) ) ) ) ) ; Random random = new Random ( ) ; remoteServerCertInfo . set ( X509CertInfo . VERSION , new CertificateVersion ( CertificateVersion . V3 ) ) ; remoteServerCertInfo . set ( ( ( ( X509CertInfo . ISSUER ) + "." ) + ( CertificateSubjectName . DN_NAME ) ) , issuer ) ; remoteServerCertInfo . set ( X509CertInfo . KEY , new CertificateX509Key ( caPublicKey ) ) ; remoteServerCertInfo . set ( X509CertInfo . SERIAL_NUMBER , new CertificateSerialNumber ( new BigInteger ( ( ( random . nextLong ( ) ) + "" ) ) ) ) ; X509CertImpl newCert = new X509CertImpl ( remoteServerCertInfo ) ; newCert . sign ( caPrivateKey , SelfSignedSslEngineSource . SIG_ALG_NAME ) ; AlgorithmId sigAlgid = ( ( AlgorithmId ) ( newCert . get ( X509CertImpl . SIG_ALG ) ) ) ; remoteServerCertInfo . set ( ( ( ( CertificateAlgorithmId . NAME ) + "." ) + ( CertificateAlgorithmId . ALGORITHM ) ) , sigAlgid ) ; CertificateExtensions extensions = ( ( CertificateExtensions ) ( remoteServerCertInfo . get ( X509CertInfo . EXTENSIONS ) ) ) ; Enumeration < Extension > elements = extensions . getElements ( ) ; CertificateExtensions newExtensions = new CertificateExtensions ( ) ; while ( ( elements != null ) && ( elements . hasMoreElements ( ) ) ) { Extension ext = elements . nextElement ( ) ; if ( ext instanceof SubjectAlternativeNameExtension ) { newExtensions . set ( SubjectAlternativeNameExtension . NAME , ext ) ; } } remoteServerCertInfo . set ( X509CertInfo . EXTENSIONS , newExtensions ) ; newCert = new X509CertImpl ( remoteServerCertInfo ) ; newCert . sign ( caPrivateKey , SelfSignedSslEngineSource . SIG_ALG_NAME ) ; KeyStore serverKeyStore = KeyStore . getInstance ( SelfSignedSslEngineSource . KEY_STORE_TYPE ) ; serverKeyStore . load ( null , SelfSignedSslEngineSource . PASSWORD . toCharArray ( ) ) ; serverKeyStore . setCertificateEntry ( SelfSignedSslEngineSource . ALIAS , newCert ) ; <START_BUG> serverKeyStore . setKeyEntry ( SelfSignedSslEngineSource . ALIAS , caPrivateKey , SelfSignedSslEngineSource . PASSWORD . toCharArray ( ) , new Certificate [ ] { newCert } ) ; <END_BUG> final KeyManagerFactory keyManagerFactory = KeyManagerFactory . getInstance ( KeyManagerFactory . getDefaultAlgorithm ( ) ) ; keyManagerFactory . init ( serverKeyStore , SelfSignedSslEngineSource . PASSWORD . toCharArray ( ) ) ; newSslContext . init ( keyManagerFactory . getKeyManagers ( ) , new TrustManager [ ] { new SelfSignedSslEngineSource . TrustEveryone ( ) } , null ) ; sslContextCache . put ( sslContextKey , new SoftReference < SSLContext > ( newSslContext ) ) ; } return newSslContext . createSSLEngine ( ) ; } catch ( Exception e ) { throw new RuntimeException ( "newSslEngine" , e ) ; } } public SSLEngine _newSslEngine ( SSLSession remoteServerSslSession ) { } public SSLContext getSslContext ( ) { } private void initializeKeyStore ( ) { } private void initializeSSLContext ( ) { } private String nativeCall ( final String ... commands ) { } private static class TrustEveryone implements X509TrustManager { public void checkClientTrusted ( java . security . cert . X509Certificate [ ] chain , String authenticationType ) { } public void checkServerTrusted ( java . security . cert . X509Certificate [ ] chain , String authenticationType ) { } public java . security . cert . X509Certificate [ ] getAcceptedIssuers ( ) { } } }

Fix:
serverKeyStore . setKeyEntry ( SelfSignedSslEngineSource . ALIAS , caPrivateKey , SelfSignedSslEngineSource . PASSWORD . toCharArray ( ) , new Certificate [ ] { newCert , caCert } ) ;